Hello everyone, I am trying to create an add-on REST API with Splunk to download a .csv file from a confluence page and push the information to Splunk.  I would like to have a table with the content of the .csv file, but so far I was just able to get one entry with 130 lines in the index and sourcetype defined by the add-on. It would help if I could split at the end of every line.. I've tried to define the sourcetype in porps.conf with line breaker and some other regex params. and at this point I don't know how to move on. Data sample:   1 UserID,Profile,Role1,Role2,Licenses,Programs,Domain,FieldX 2 user139,Profile description,Role 1,Role 2,"lic1,lic2,lic3,lic4,lic5,lic6",protram,domain,extra_field . . 130 user139,Profile description,Role 1,Role 2,"lic1,lic2,lic3,lic4,lic5,lic6",protram,domain,extra_field   I've tried to reproduce the content as best as I could, included spaces. The content between the quotes "", all belong to the header "licenses". ... View more

Hello, We are running DB Connect v3.1.4 on a Linux machine and for the first time we are trying to connect to an SQL Server database via Windows authentication. We were always using local database accounts before, now the database admin configured one of our service account registered in the Active Directory to access the database. Our user is "domain\username", we tried using the driver "MS-SQL Server Using MS Generic Driver With Windows Authentication", but when testing the new connection we get the error " This driver is not configured for integrated authentication. ClientConnectionId: etc... We checked the box in the identity creation to specify the domain and Splunk DB Connect does display the driver "MS-SQL Server Using MS Generic Driver With Windows Authentication" with a green check mark in the list of installed drivers. Do we need to install "MS-SQL Server Using jTDS Driver With Windows Authentication" instead ? Or is there another issue ? Thank you ! ... View more

Hello everyone, We have configured some automatic field extractions using regular expressions on some logs that can get really big. These field extractions are very important, if they fail we are missing critical information in our daily monitoring. At some point the field extraction didn't work and we realized that was because of the regex depth limit, when we ran it manually with rex and we got     Streamed search execute failed because: Error in 'rex' command: regex="<the_regex>" has exceeded the configured depth_limit, consider raising the value in limits.conf.     We fixed it by optimizing the regex and now it's working fine. But we cannot be sure that the issue has been absolutely fixed, it could potentially happen again in the future. We would like to configure a Splunk alert that warns us when this type of error occurs. Does Splunk log anything about this type of error ? We could not find anything in _internal or anywhere else, or maybe we didn't look correctly ? Thank you for your help ! ... View more